D-Link DWS-1008 User Manual page 310

DWS-1008 User's Manual
Applying Security ACLs in a Location Policy Rule
When reassigning security ACL filters, specify whether the filter is an input filter or an output
filter, as follows:
• Input filter - Use inacl inacl-name to filter traffic that enters the switch from users via
a DWL-8220AP access port or wired authentication port, or from the network via a
network port.
• Output filter - Use outacl outacl-name to filter traffic sent from the switch to users via
a DWL-8220AP access port or wired authentication port, or from the network via a
network port.
For example, the following command authorizes users at *.ny.ourfirm.com to access the
bld4.tac VLAN, and applies the security ACL tac_24 to the traffic they receive:
DWS-1008# set location policy permit vlan bld4.tac outacl tac_24 if user eq *.ny.
ourfirm.com
The following command authorizes access to users on VLANs with names matching bld4.*
and applies security ACLs svcs_2 to the traffic they send and svcs_3 to the traffic they
receive:
DWS-1008# set location policy permit inacl svcs_2 outacl svcs_3 if vlan eq bldg4.*
You can optionally add the suffixes .in and .out to inacl-name and outacl-name for consistency
with their usage in entries stored in the local DWS-1008 switch database.
Displaying and Positioning Location Policy Rules
The order of location policy rules is significant. MSS checks a location policy rule that is
higher in the list before those lower in the list. Rules are listed in the order in which you
create them, unless you move them.
To position location policy rules within the location policy, use before rule-number and
modify rule-number in the set location policy command, or use the clear location policy
rule-number command.
For example, suppose you have configured the following location policy rules:
DWS-1008 show location policy
Id Clauses
----------------------------------------------------------------
1) deny if user eq *.theirfirm.com
2) permit vlan guest_1 if vlan neq *.ourfirm.com
3) permit vlan bld4.tac inacl tac_24.in if user eq *.ny.ourfirm.com
4) permit inacl svcs_2.in outacl svcs_3.out if vlan eq bldg4.*
D-Link Systems, Inc.
Configuring AAA for Network Users
305